Most findings in a web security audit don't come from fancy exploits: they come from configuration - missing headers, legacy TLS, cookies without attributes and exposed files. The good news: you can map all of this 100% passively in under a minute.
What to check first
| Area | Check | Why it matters |
|---|---|---|
| Headers | HSTS (max-age, subdomains) | Without HSTS users can be downgraded to plain HTTP |
| Headers | CSP (unsafe-inline/eval, default-src) | A strict CSP shrinks the blast radius of XSS |
| Headers | X-Content-Type-Options: nosniff | Prevents MIME sniffing |
| Headers | X-Frame-Options / frame-ancestors | Clickjacking protection |
| TLS | Expired certs, TLS 1.0/1.1 accepted | Legacy = instant fail in any serious audit |
| Cookies | Secure / HttpOnly / SameSite | Session hijacking is trivial without them |
| CORS | Reflected origins, wildcard with credentials | Cross-origin data leaks |
| Files | .env, .git, dumps, backups returning 200 | Classic "easy to fix, impossible to dispute" findings |
Automating it with reconpp
I wrote reconpp, a Python CLI with zero dependencies (stdlib only) that runs all these checks and produces a delivery-ready report:
pip install git+https://github.com/bryanrafaelbueno/reconpp
reconpp -u https://your-site.com -f md -o report.md
Sample output (summary + severity per finding):
summary: {'PASS': 9, 'INFO': 4, 'WARN': 4, 'FAIL': 0}
[X] cookies | Cookie 'JSESSIONID' - Secure flag | Cookie may travel over HTTP.
fix: Add the 'Secure' attribute to every cookie.
Every finding comes with a description + recommended fix - you can turn the markdown into a ticket immediately.
The full checklist (pt-BR)
The complete 70+ point checklist lives in my ebook "Web Security Audit na Prática" (Brazilian Portuguese): a 5-phase methodology, passive detection for OWASP-style issues (injection, XSS, CSRF, SSRF, IDOR, upload, deserialization) and a consultancy-grade report template. Free sample available at the store:
- Store (Pix, instant delivery): https://bryanrafaelbueno.github.io/audit-br-store/
- Free sample (PDF): https://bryanrafaelbueno.github.io/audit-br-store/sample.pdf
Golden rule
Everything shown here is passive - but auditing, even passive, only on systems you own or have written authorization for. No exceptions.
Feedback and issues welcome on the repo. 🛡️
Top comments (1)
Direct comparison worth making honestly: we built something in the same space (security-scan, headers + reputation + subdomain discovery combined into one score), and your checklist covers real ground ours doesn't touch at all — TLS version/cert expiry, cookie attribute checks (Secure/HttpOnly/SameSite), CORS reflected-origin detection, and the exposed-file sweep (.env, .git, backups returning 200). That last one especially — checking for accidentally-exposed files is such a "boring but catches real incidents" category, and it's not something we check for at all right now.
Curious about one design choice: how do you handle the CORS reflected-origin check without sending a real cross-origin request that could itself look like probing? That's the part of "100% passive" I'd find hardest to pull off cleanly for that specific check.